/* DELETED
*/

/* XXX DOES NOT USE BUILT-IN DETECTION FUNCTION XXX
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT Microsoft Office Excel FtCbls remote code execution attempt"; flowbits:isset,file.xls; flow:to_client,established; content:"|5d 00|"; content:"|15 00 12 00|"; distance:2; within:4; content:"|0a 00 0c 00|"; distance:0; metadata:policy balanced-ips drop, policy security-ips drop, service http; reference:cve,2009-0557; reference:url,technet.microsoft.com/en-us/security/bulletin/MS09-021; classtype:attempted-user; sid:15520; rev:1;)
*/
/*
 * Use at your own risk.
 *
 * Copyright (C) 2005-2008 Sourcefire, Inc.
 * 
 * This file is autogenerated via rules2c, by Brian Caswell <bmc@sourcefire.com>
 */


#include "sf_snort_plugin_api.h"
#include "sf_snort_packet.h"

#include "so-util.h"

//#define DEBUG 1
#ifdef DEBUG
#define DEBUG_WRAP(code) code
#else
#define DEBUG_WRAP(code)
#endif

/* declare detection functions */
int rule15520eval(void *p);

/* declare rule data structures */
/* precompile the stuff that needs pre-compiled */
/* flowbits:isset "file.xls"; */
//DELETEDstatic FlowBitsInfo rule15520flowbits0 =
//DELETED{
//DELETED    "file.xls",
//DELETED    FLOWBIT_ISSET,
//DELETED    0,
//DELETED};
//DELETED
//DELETEDstatic RuleOption rule15520option0 =
//DELETED{
//DELETED    OPTION_TYPE_FLOWBIT,
//DELETED    {
//DELETED        &rule15520flowbits0
//DELETED    }
//DELETED};
/* flow:established, to_client; */
static FlowFlags rule15520flow1 = 
{
    FLOW_ESTABLISHED|FLOW_TO_CLIENT
};

static RuleOption rule15520option1 =
{
    OPTION_TYPE_FLOWFLAGS,
    {
        &rule15520flow1
    }
};
//DELETED// content:"]|00|", depth 0; 
//DELETEDstatic ContentInfo rule15520content2 = 
//DELETED{
//DELETED    (uint8_t *) "]|00|", /* pattern (now in snort content format) */
//DELETED    0, /* depth */
//DELETED    0, /* offset */
//DELETED    CONTENT_RELATIVE|CONTENT_BUF_NORMALIZED, /* flags */
//DELETED    NULL, /* holder for boyer/moore PTR */
//DELETED    NULL, /* more holder info - byteform */
//DELETED    0, /* byteform length */
//DELETED    0 /* increment length*/
//DELETED};

// content:"asdfasdfas0df0sfj0j4323458234589j24389jersdfgdfgDELETED", depth 0; 
static ContentInfo rule15520content2 =
{
    (uint8_t *) "asdfasdfas0df0sfj0j4323458234589j24389jersdfgdfgDELETED", /* pattern (now in snort content format) */
    0, /* depth */
    0, /* offset */
    CONTENT_BUF_NORMALIZED|CONTENT_FAST_PATTERN, /* flags */
    NULL, /* holder for boyer/moore PTR */
    NULL, /* more holder info - byteform */
    0, /* byteform length */
    0 /* increment length*/
};

static RuleOption rule15520option2 = 
{
    OPTION_TYPE_CONTENT,
    {
        &rule15520content2
    }
};
//DELETED// content:"|15 00 12 00|", offset 2, depth 4, relative; 
//DELETEDstatic ContentInfo rule15520content3 = 
//DELETED{
//DELETED    (uint8_t *) "|15 00 12 00|", /* pattern (now in snort content format) */
//DELETED    4, /* depth */
//DELETED    2, /* offset */
//DELETED    CONTENT_RELATIVE|CONTENT_BUF_NORMALIZED, /* flags */
//DELETED    NULL, /* holder for boyer/moore PTR */
//DELETED    NULL, /* more holder info - byteform */
//DELETED    0, /* byteform length */
//DELETED    0 /* increment length*/
//DELETED};
//DELETED
//DELETEDstatic RuleOption rule15520option3 = 
//DELETED{
//DELETED    OPTION_TYPE_CONTENT,
//DELETED    {
//DELETED        &rule15520content3
//DELETED    }
//DELETED};
//DELETED// content:"|0A 00 0C 00|", depth 0, relative; 
//DELETEDstatic ContentInfo rule15520content4 = 
//DELETED{
//DELETED    (uint8_t *) "|0A 00 0C 00|", /* pattern (now in snort content format) */
//DELETED    0, /* depth */
//DELETED    0, /* offset */
//DELETED    CONTENT_RELATIVE|CONTENT_BUF_NORMALIZED, /* flags */
//DELETED    NULL, /* holder for boyer/moore PTR */
//DELETED    NULL, /* more holder info - byteform */
//DELETED    0, /* byteform length */
//DELETED    0 /* increment length*/
//DELETED};
//DELETED
//DELETEDstatic RuleOption rule15520option4 = 
//DELETED{
//DELETED    OPTION_TYPE_CONTENT,
//DELETED    {
//DELETED        &rule15520content4
//DELETED    }
//DELETED};

/* references for sid 15520 */
/* reference: cve "2009-0557"; */
//DELETEDstatic RuleReference rule15520ref1 = 
//DELETED{
//DELETED    "cve", /* type */
//DELETED    "2009-0557" /* value */
//DELETED};
//DELETED
//DELETED/* reference: url "technet.microsoft.com/en-us/security/bulletin/MS09-021"; */
//DELETEDstatic RuleReference rule15520ref2 = 
//DELETED{
//DELETED    "url", /* type */
//DELETED    "technet.microsoft.com/en-us/security/bulletin/MS09-021" /* value */
//DELETED};

static RuleReference *rule15520refs[] =
{
//DELETED    &rule15520ref1,
//DELETED    &rule15520ref2,
    NULL
};
/* metadata for sid 15520 */
/* metadata:service http, policy balanced-ips drop, policy security-ips drop; */
//DELETEDstatic RuleMetaData rule15520service1 = 
//DELETED{
//DELETED    "service http"
//DELETED};
//DELETED
//DELETED
//DELETEDstatic RuleMetaData rule15520policy1 = 
//DELETED{
//DELETED    "policy balanced-ips drop"
//DELETED};
//DELETED
//DELETEDstatic RuleMetaData rule15520policy2 = 
//DELETED{
//DELETED    "policy security-ips drop"
//DELETED};


static RuleMetaData *rule15520metadata[] =
{
//DELETED    &rule15520service1,
//DELETED    &rule15520policy1,
//DELETED    &rule15520policy2,
    NULL
};

RuleOption *rule15520options[] =
{
//DELETED    &rule15520option0,
    &rule15520option1,
    &rule15520option2,
//DELETED    &rule15520option3,
//DELETED    &rule15520option4,
    NULL
};

Rule rule15520 = {
   
   /* rule header, akin to => tcp any any -> any any               */{
       IPPROTO_TCP, /* proto */
       "$EXTERNAL_NET", /* SRCIP     */
       "$HTTP_PORTS", /* SRCPORT   */
   
       0, /* DIRECTION */
       "$HOME_NET", /* DSTIP     */
   
       "any", /* DSTPORT   */
   },
   /* metadata */
   { 
       3,  /* genid */
       15520, /* sigid */
       10, /* revision */
   
       "attempted-user", /* classification */
       0,  /* hardcoded priority XXX NOT PROVIDED BY GRAMMAR YET! */
       "DELETED WEB-CLIENT Microsoft Office Excel FtCbls remote code execution attempt",     /* message */
       rule15520refs /* ptr to references */
       ,rule15520metadata
   },
   rule15520options, /* ptr to rule options */
   NULL, // RULE IS DELETED &rule15520eval, /* DO NOT use the built in detection function */
   0 /* am I initialized yet? */
};


/* detection functions */
int rule15520eval(void *p) {

   return RULE_NOMATCH;

//DELETED    const uint8_t *cursor_normal = 0;
//DELETED    SFSnortPacket *sp = (SFSnortPacket *) p;
//DELETED
//DELETED    const uint8_t *end_of_payload;
//DELETED    const uint8_t *end_of_obj;
//DELETED    const uint8_t *cursor_detect;
//DELETED        
//DELETED    uint16_t obj_size; // OBJ record size    
//DELETED    uint32_t unused1;
//DELETED    uint32_t unused2;
//DELETED    
//DELETED    uint16_t subrecord_type; // ft 
//DELETED    uint16_t subrecord_size; // cb
//DELETED
//DELETED    DEBUG_WRAP(const char *name="rule15520eval";)
//DELETED    DEBUG_WRAP(printf("%s: enter\n", name);)    
//DELETED    
//DELETED    if(sp == NULL)
//DELETED        return RULE_NOMATCH;
//DELETED
//DELETED    if(sp->payload == NULL)
//DELETED        return RULE_NOMATCH;
//DELETED    
//DELETED    // flowbits:isset "file.xls";
//DELETED    if (processFlowbits(p, rule15520options[0]->option_u.flowBit) > 0) {
//DELETED        // flow:established, to_client;
//DELETED        if (checkFlow(p, rule15520options[1]->option_u.flowFlags) > 0 ) {
//DELETED
//DELETED            if(getBuffer(sp, CONTENT_BUF_NORMALIZED, &cursor_normal, &end_of_payload) <= 0)
//DELETED               return RULE_NOMATCH;
//DELETED
//DELETED            // content:"]|00|", depth 0;  // OBJ record type "|5d 00|"
//DELETED            while (contentMatch(p, rule15520options[2]->option_u.content, &cursor_normal) > 0) {
//DELETED
//DELETED                if ((cursor_normal + 2) > end_of_payload)
//DELETED                    return RULE_NOMATCH;                    
//DELETED               
//DELETED                obj_size = read_little_16(cursor_normal);
//DELETED                if (obj_size < 22)
//DELETED                    continue;
//DELETED
//DELETED                cursor_detect  = cursor_normal;
//DELETED                end_of_obj = cursor_detect + obj_size + 2;                
//DELETED                DEBUG_WRAP(printf("%s: OBJ record size = 0x%04x\n", name, obj_size);)
//DELETED
//DELETED                if (end_of_obj > end_of_payload) // since we are doing a negative search of linkFmla, we want check whole OBJ record
//DELETED                    return RULE_NOMATCH;
//DELETED                
//DELETED                // content:"|15 00 12 00|", offset 2, depth 4, relative;
//DELETED                if (contentMatch(p, rule15520options[3]->option_u.content, &cursor_detect) > 0) {
//DELETED                    // content:"|0A 00 0C 00|", depth 0, relative;
//DELETED                    if (contentMatch(p, rule15520options[4]->option_u.content, &cursor_detect) > 0) {
//DELETED                                                
//DELETED                        if (cursor_detect + 8 >= end_of_obj)
//DELETED                            return RULE_NOMATCH;
//DELETED
//DELETED                        DEBUG_WRAP(printf("%s: FtCbls sub-record found\n", name);)
//DELETED
//DELETED                        // Since we need to check if unused1 != 0 or unused2 != 0, we don't care about endiaaness
//DELETED                        unused1 = *((uint32_t *)cursor_detect);
//DELETED                        cursor_detect += 4;
//DELETED                        DEBUG_WRAP(printf("%s: FtCbls unused1 = 0x%08x\n", name, unused1);)
//DELETED                            
//DELETED                        unused2 = *((uint32_t *)cursor_detect);
//DELETED                        DEBUG_WRAP(printf("%s: FtCbls unused2 = 0x%08x\n", name, unused2);)
//DELETED
//DELETED                        if (unused1 == 0 && unused2 == 0)                            
//DELETED                            return RULE_NOMATCH;
//DELETED
//DELETED                        cursor_detect += 8;
//DELETED
//DELETED                        // search for linkFmla sub-record
//DELETED                        while (cursor_detect + 4 < end_of_obj)
//DELETED                        {
//DELETED                            subrecord_type = read_little_16(cursor_detect);
//DELETED                            
//DELETED                            if (subrecord_type == 0)  // it reaches to the "reserved" field
//DELETED                            {
//DELETED                                DEBUG_WRAP(printf("%s: linkFmla (0x0014 or 0x000E) is NOT found\n", name);)
//DELETED                                break;
//DELETED                            }
//DELETED                                
//DELETED                            DEBUG_WRAP(printf("%s: sub-record type = 0x%04x\n", name, subrecord_type);)
//DELETED
//DELETED                            if (subrecord_type == 0x14 || subrecord_type == 0xe)
//DELETED                            {
//DELETED                                DEBUG_WRAP(printf("%s: linkFmla (0x0014 or 0x000E) is found\n", name);)
//DELETED                                return RULE_NOMATCH;
//DELETED                            }
//DELETED
//DELETED                            cursor_detect += 2;
//DELETED                            subrecord_size = read_little_16(cursor_detect);
//DELETED                            cursor_detect += subrecord_size + 2; 
//DELETED                        }
//DELETED
//DELETED                        return RULE_MATCH;
//DELETED                    }
//DELETED                }
//DELETED            }
//DELETED        }
//DELETED    }
//DELETED    return RULE_NOMATCH;
}

/*
Rule *rules[] = {
    &rule15520,
    NULL
};
*/

